CVE-2023-25802: Roxy-Wi

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename` sequences, such as `/etc/nginx/../passwd`, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue.

Affected products

• Roxy-Wi Roxy-Wi: before 6.3.6.0 (fixed in 6.3.6.0)

Published 2023-03-13. Last modified 2026-06-17.